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ABSTRACT 



In June 1995, the U.S. Department of Education issued an 
audit guide that required that all institutions participating in Title IV 
programs have an annual compliance audit. This guide contains a notice to 
institutions and third party servicers that, to the extent that an 
institution contracts with a server to administer any aspect of Title IV 
programs, the applicable compliance requirements also apply to the server. 
This document also contains an update to the 1995 Audit Guide that provides 
guidance to the independent public accountants engaged to audit functions 
performed by institutions servers, identifies additional compliance 
requirements, clarifies some existing requirements, and includes information 
on changes that result from regulations effective as of July 1, 1997. Some 
portions of the guide update are pages to be inserted into the original; 
other sections contain pen-and-ink changes to be inserted. (SLD) 



Reproductions supplied by EDRS are the best that can be made 
from the original document. 
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UNITED STATES DEPARTMENT OF EDUCATION 



OFFICE OF INSPECTOR GENERAL 



THE INSPECTOR GENERAL 



July, 1997 



OIG-97-1 



Dear Colleague: 



In June 1995, we transmitted by Dear Colleague letter the U.S. Department of Education's (ED) 
Audit Guide, Compliance Audits (Attestation Engagements ) of the Federal Student Financial 
Assistance Programs at Participating Institutions (Guide). That Guide required all institutions 
participating in Title IV HEA Programs to have an annual compliance audit, and applied to award 
years ending June 30, 1995, and thereafter. This letter serves as notice to institutions and third 
party servicers that, to the extent that an institution contracts with a servicer to administer any 
aspect of the Title IV HEA Programs, the applicable compliance requirements contained in the 
Guide also apply to that servicer. 

Accompanying this letter is an update to the Guide that provides guidance to independent public 
accountants (IP A) engaged to audit functions performed by institution servicers when the functions 
performed are applicable to the administration of the Title IV HEA Programs, and provides 
guidance when auditing and reporting on a servicer's compliance with the Title IV requirements. 
This update also provides clarifications, identifies additional compliance requirements and 
management assertions applicable to institutions and institution servicers, and includes information 
on changes required as a result of regulations that are effective July 1, 1997. Care must be 
exercised to ensure that laws and regulations applicable to the audit period are being used as 
criteria for the determination of compliance. 

Please note that audit packages submitted under this Audit Guide must contain all the components 
required by the Guide, including all the required elements listed on page 1-13 or III-7 and 8 of the 
Guide, as applicable. Audit packages submitted without all the required components are 
incomplete and will be rejected and returned to the institution or servicer. Institutions and 
servicers that do not submit a complete audit in accordance with the Audit Guide may be subject 
to administrative sanctions pursuant to 34 CFR 668 Subpart G. 
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This update consists of a list of changes to be made by pen and ink as well as new and revised 
pages to be inserted to the Guide. In lieu of making the pen and ink changes and inserting new 
pages and sections, an updated version of the audit guide (SFA Audit Guide-Updated 1997) with 
these changes already inserted is available on the Internet at this URL: 
http://home.gvi. net/"edoig/. The Guide as amended by this update must be used by the IPA for 
performing the compliance audits of any institution or institution servicer participating in or 
administering any aspect of Title IV HEA Programs, except for institution or institution servicers 
which obtain an audit in accordance with the Office of Management and Budget Circulars A-128 
or A-133. 



Questions pertaining to the Guide and update should be faxed directly to the Non-Federal Audit 
Team at (214) 767-2024. We look forward to working with you to implement the compliance 
audit requirements for Title IV HEA program institution^ and institution servicers. 

Sincerely, 




/ M 



i Thomas R. Bloom 
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JUNE 1995 SFA AUDIT GUIDE CHANGES 




The following are changes that must be made to several pages of the June 1995 SFA Audit Guide. 
The words in italics are those that must be added, words with double underlines must be deleted, 
and the deletion and addition of paragraphs and pages are self-explanatory. After making the 
changes, please take a few minutes to review this information to ensure that you understand the 
ramifications of the changes. 



Section & 
Page No. 



Contents Remove pages i and ii, insert attached pages i through tv 

1-1 Caption at top of the page should read: PLANNING AND OTHER 

CONSIDERATIONS FOR AUDITS OF INSTITUTIONS 




1-2 

1-2 

1-3 

1-4 

1-4 




Third paragraph, should read: This guide is to be used by all institutions ( including 
foreign schools) which administer SFA funds, with one exception: 

Public colleges, State and local universities, and nonprofit institutions audited in 
accordance with OMB Circular A-133 or its predecessors. NOTE: Organizations 
whose funding is below OMB Circular A-133 's threshold (currently $300,000 per 
fiscal year) are exempt from submitting a single audit to the Department under 
OMB Circular A-133. The organization may be asked to submit to the Department 
copies of any financial statement or compliance audits that are otherwise prepared 
for the institution. 

Fourth paragraph should read: This guide is divided into five sections: 

Caption, Section I should read: Sections I and III 
Caption, Section II should read: Sections II and TV 
Caption, Section III, change the III to V 

Replace this page with attached pages I-3a, I-3b and I-3c. 

Delete first two paragraphs and the address. 

Auditor Qualifications, first paragraph, line 2 should read: Standards, including 
continuing education and peer review requirements. 

Add this paragraph at the bottom of the page under the caption Auditor 
Qualifications: The IPA and audit firms must comply with the applicable provisions 
of the public accountancy law and rules of the country in which they 
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are licensed and where the engagement is being performed. If the country does not 
have any public accountancy law or professional standards, the IP A must follow 
United States standards. 


1-6 


Third paragraph. second line. Delete compliance attestation and insert audit. Last 
line, delete III and insert V. 


1-6 


Fourth DaraeraDh. first line. Delete Compliance attestation reports and insert Audit 
report packages 


1-6 


Last paragraph, fifth line. After the word, All, insert institution 


1-7 


Student Confirmations. First sentence should read: The IPA should consider 
sending positive confirmations to verify student existence and attendance at the 
institution. 


1-7 


Above the caption Financial Statement Audit, insert the caption AUDIT REPORT 
PACKAGE and this sentence: The institution shall transmit five copies of the 

institution ’s audit report package and its corrective action plan to the address listed 
at the top of page 1-13. 


1-7 


On the caption, Financial Statement Audit, delete the word Audit and add an “s " 
to the end of the word Statement. 


1-7 


Insert this paragraph just prior to the caption, Management and Legal Counsel 
Representation Letters 

Foreign institutions' financial statements may be prepared in accordance with the 
generally accepted accounting principles of the institution ’s home country if the 
institution administered less than $500,000 of Title TV funds during its fiscal year. 
Institutions administering more than $500,000 per fiscal year must have their 
financial statements translated into United States standards (34 CFR 668.15). 


1-8 


85/15 Attestation. Delete the word Attestation and insert Revenue Test. Delete the 
sentence: ED will provide guidance which will address the 85/15 attestation, 
which is effective Julv 1. 1995. and other financial statementissues. Insert a new 
sentence: A proprietary institution must disclose in a footnote to its audited 
financial statements the percentage (including the figures used to make the 
calculation) of its revenues derived from the Title TV funds received during the 
fiscal year covered by that audit (34 CFR 668.23). The calculation must be made 
on a cash basis and in accordance with 34 CFR 600.5. 
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1-8 Contact Office. Delete the address and telephone numbers and insert: 

U. S. Department of Education 

Performance Improvement and Procedures Division, IPOS 

Attn: Financial Analysis 

600 Independence Avenue, SW 

ROBS, Room 3682 

Washington, DC 20202-5265 

Tel. (202) 260-5742 

Fax: (202) 708-6730 

1-8 Under the caption Financial Statement Reporting, the sentence should read: An 

institution’s financial statement portion of the audit report package must include the 
following: 

1-8 Under the caption, Financial Statement Reporting, item 3. At the end of the 

sentence replace the semicolon with a period, delete the word and. 

1-8 Bottom of page, paragraph starting Please refer. . . . , delete entire paragraph. Insert: 

The requirements for the compliance portion of the audit report package start at the 
bottom of page 1-12. 

1-9 Top of page, delete both addresses. 

1-9 Caption, Compliance Attestation Engagement, second paragraph, first line. Insert 

after the word in: Section II of 

1-9 After the second paragraph under Compliance Attestation Engagement, insert this 

header and paragraph: 

Computer and Electronically Processed Data 

Because of the growth in the use of computers, institutions are processing SFA 
information electronically; however, the IPAs audit objectives do not change. IPAs 
should consider the controls over computers and the SFA information processed 
electronically. Some items to be considered are: Operating procedures, processing 
schedules, physical and internal computer security (location and accessability to 
terminals, controls over passwords, etc), reliability of computer processed data, 
computer backup schedules, and disaster recovery plans. 
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1-10 Fourth line of paragraph under the caption, Sampling Methodology, delete the 

word award and insert fiscal. 

1-11 In the formula, replace the word award with fiscal. 

1-1 1 In both Approaches, I and II, in both items, 1 and 2, replace the word award with 

fiscal. 

1-12 Third line in the third paragraph under Sample Results. Delete the words, £D 

diskette . Last sentence, delete the phrase. To download the software for Example 
E, and insert at the end of that sentence: for submitting Example E. 

1-12 Following the caption. Compliance Attestation Reporting, delete the sentence and 

replace with: The compliance report section of the institution 's audit report 

package must start with a page which clearly indicates the programs, sites, and 
period which were examined (Example B). A complete audit report package must 
be mailed to: 

1-13 Address at top of the page, delete the third and fourth lines and insert: Data 

Management and Analysis Division, IPOS. Fifth line of address should 
read: ROB 3, Room 3522 

1-13 The sentence after the address should read: The compliance portion of the 

institution’s report package must include the following: 

1-13 Item 1, after the parenthetical expression, (Example C), insert: and if the institution 

uses a servicer, the Servicer Information Sheet (Example C-l) 

1-13 Item 3, after the words Example E, delete the word on diskette and insert - See 

Appendix D 

D-l Start of the title, insert the word Institution ’s. 

D-l Item 2 should read: Briefly describes the related compliance requirements; and 

D-l First bullet, 34 CFR Parts, second line, delete July 1. 1994 and the rest of the 

sentence and insert: July 1, 1996 and final regulations issued for 34 CFR Parts 
668, 673, 674, 675, 676 and 690 on November 27, 1996; Parts 600 and 668 on 
November 29, 1996; and Parts 668, 674, 675, 676, 682, 685, and 690 on 
November 29, 1996. 
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II- 1 


After the second bullet, ED “Dear Colleague” Letters, insert a new bullet: 
The Direct Loan School Guide for the year(s) being audited. 


n-i 


Third indented bullet after the bullet, The institutions: , after the word Monthly 
insert: Cash Summary and Data Matching 


ii-i 


At the bottom of the Daee delete the sentence: AlLcomDliance testing is based on 
the award vear ending June 30th durine the entityls fiscal year. 


II-2 


First bullet, delete the Dhrase. covering the award vear. 


II-2 

» 


Compliance Requirements, second indented bullet after the first bullet. 

Add a third bullet as follows: 

Undergraduate programs offered in credit hours must meet certain requirements 
for the amount of instruction provided in each credit hour, unless exempted by 
regulation. The requirements are spelled out in 34 CFR 668.8 (k) and (l) and 
668.9. Dear Colleague Letter (DCL) GEN-95-38 dated August 1995 notified 
institutions of the actions they must have taken to assure they were in compliance 
with the requirements. Note: DCL GEN-95-38 can be obtained by calling 1-800- 
4FEDAID or accessing the SFA electronic Bulletin Board System. 


II-2 


Second and third bullets. Replace the word award with fiscal. 


II-3 


Second bullet. At the end after the word, year, insert: that ended during the 
institution ’s fiscal year. 


II-3 


After the bullets but before the first full paragraph on this page insert these 
compliance requirements: 

Published and distributed to required parties, an annual campus crime report that 
contains all the required information at 34 CFR 668.47. 

Prepared and disseminated to all enrolled students or prospective students by 
mailing or appropriate publications, annual information regarding completion or 
graduation rates and transfer-out rates of certificate or degree-seeking full-time 
undergraduate students. A similar annual published report on student athletes is 
also required(34 CFR 668.41, 668.46 and 668.49). 
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Prepared annually, for institutions offering “athletically related student aid ” a 
compilation of revenues and expenses of intercollegiate athletic activities by specific 
sports which must be independently audited at least every three years and must be 
made available to the public (34 CFR 668.14). 

II-3 Suggested Procedures, item b, 2. Change award year to fiscal year. 

n-4 Insert after suggested procedure number 4 : 

5. If the institution offers undergraduate programs in credit hours, determine 

if the institution followed 34 CFR 668.8 (k) and (l) and 668.9 and DCL 
GEN-95-38 guidance, as applicable. Obtain, review and verify that any 
required clock to credit hour conversion (s) conform to requirements. 

II-4 On this page replace the term, award year, with fiscal year except as noted in the 

following change. 

II -4 Suggested Procedure g should read: Obtain from the institution its calculation of 

its award year institutional eligibility ratios. 

II-5 Suggested Procedure h, after this procedure insert: 

i. Obtain and inspect the annual security report. Verify that the report contains 
all information required by 34 CFR 668.47 and was distributed as required. 

j. Verify that the annual information regarding completion or graduation rates and 
the transfer-out rates of certificate or degree-seeking full-time undergraduate 
students was disseminated to all enrolled students or prospective students. Verify 
that the information on student athletes was published in an annual report. On a 
test basis, trace and verify the information. 

k. If applicable, obtain and review the annual report regarding intercollegiate 
athletics. Verify the report revenues and expenses include all applicable sport 
activities and that an audit report is issued every three years. 

n-6 First bullet, change the year from 1993 to 1995 and replace comma at end of 

sentence with a period and insert: Note: The ED CAPS system will be replacing the 
PMS 272 sometime in late calendar 1997 or early 1998. There will be an EDCAPS 
Recipient ’s Guide; the IP A should review that Guide and adjust the Suggested 
Procedures below accordingly. 
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n-6 Second bullet should read: FDLP monthly reconciliation report including (34 CFR 

685.308): 

Loan Detail Records, 

Cash Detail Records, and 

Summary Records that include totals of each type of cash and loan detail 

record. 

II-6 Third bullet should read: SSCRs [34 CFR 682.610(c) and 34 CFR 685.308(b)] 

II-6 Next paragraph, first sentence, second line. After the term, Pell awards, insert: 

that were and after the word, to, insert: ED., delete the remainder of the sentence, 
or under-reported to the Pell Grant Financial Management Division . Next 
sentence after the word in, delete the word, jyj, and insert: the original timely 
filed... In the reference, delete (cl or tel and insert: and 668.23. 

II-6 Suggested Procedures, a, third bullet, delete the phrase: to guarantee agencies . 

II-7 Suggested Procedure c, delete the procedure and item 1 and insert: 

Obtain monthly reconciliation reports and the FDLP guidance on this subject for 
the audit period. 

1. On a test basis determine that the institution submitted the required monthly 

reconciliations. 

n-7 Suggested Procedure c, 2. Delete the word, cash . 

II-7 Suggested Procedure c, 2, b. Delete word Service r, insert Loan Origination Center 

(LOC). 

II-7 Suggested Procedure c, 3. Renumber as 4 and insert a new procedure 3 as follows: 

3. As applicable and on a test basis, determine that the data in the institution 's 
system is reconciled to the FDLP software system. 

II-7 Suggested Procedure d. After the word, of, insert FFELP and FDLP 
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n-7 Bottom of page. Suggested Procedure e. Insert: 1. in front of the procedure and 

insert: 2. Documentation supporting the Pell adjustment request must be included 
in the transmittal of the audit report package. Follow applicable guidance in Dear 
Colleague Letter GEN 94-14 or its successor 

n-9 Delete this page and insert revised pages II-9a and II-9b attached. 

n-10 Ninth bullet regarding signed Statements - delete: Selective Service Registration 

and insert: on Overpayments and Defaults. The references should read: (34 CFR 
668.7 and 668.32). 

II- 1 1 Suggested Procedures, item a, second paragraph. Add this reference at the 

end of the paragraph: 34 CFR 668 Subpart J, Sections 141 through 156. 

11-12 Suggested Procedures, First paragraph 3, delete and insert: 

If the test is not given at an assessment center, determine if the test administrator 
forwards test results within two days to the test publisher for scoring. 

11-12 Suggested Procedures, Item c, 9, delete and replace with: 

Has evidence of a signed FAFSA, Renewal Application, or if filed electronically, 
evidence of a signed “echo document. ” 

11-14 After the caption. Payment Periods, delete the paragraph and replace with the 

information on the new page II- 14a. 

n-14 To the right of the caption. Pell, delete the first paragraph. 

H-15 Disbursement Criteria, column. Institutions must, first box: delete the 

words, 3 weeks , and insert 10 days, in the reference delete all numbers 
after 34 CFR except for 668.165. 

Second box, delete the reference and replace with: (34 CFR 668.164) 

11-15 First footnote under disbursement criteria box, delete the word: any , and insert an 

a in its place, delete the phrase, at that institution , at the end of the sentence. 

11-16 After the end of the sentence at the top of the page insert: Loan funds provided 

by electronic fund transfer or master check may not be requested earlier than: 27 
days after the first day of classes of the first payment period for a first-year, 
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first-time borrower; or 13 days before the first day of classes for any subsequent 
payment period for a first-year, first-time or for any payment period for all other 
FFEL borrowers. (34 CFR sections 682.603, 682.604 and 668.167). 

II- 16 delete the paragraph after the caption FDLP and insert the following: The 

institution must determine that the student maintained continuous eligibility from 
the beginning of the loan period described in the promissory note. Option 1 and 
Option 2 institutions may not disburse loan proceeds until they have obtained a 
legally enforceable promissory note. Option 1 and standard origination institutions 
may only disburse funds for students listed on the Actual Disbursement Roster. All 
institutions must submit disbursement records to the loan origination center no 
later than 30 days following the date of disbursement. Option 1 and Option 2 
institutions must also submit loan origination records and promissory notes within 
30 days of the initial loan disbursement (34 CFR section 685.303 and 301). 

11-16 Suggested Procedure a, third bullet should read: Requesting and disbursing.... 

11-16 Suggested Procedure b, 1, delete words: three weeks , and insert: 10 days. 

11-17 Suggested Procedure e at top of page, delete (for Pell at institutions with 

nonstandard terms or clock hours). 

11-17 After Suggested Procedure e at the top of the page insert: 

/. Request, for FFELP loan proceeds transmitted by EFT or master check, the 
funds earlier than, as appropriate, the 27 and 13 day restrictions. 

11-17 Suggested Procedure b should read: Has obtained a legally enforceable FDLP 

promissory note; 

11-17 Suggested Procedure c, should read: Disbursed (for FDLP Schools) loan proceeds 

only for students listed on the Actual Disbursement Roster (Option 1 and standard 
origination schools); input actual (not estimated) disbursement dates in the FDLP 
software system; submitted initial disbursement records, loan origination records 
and promissory notes to the LOC within 30 days of the initial disbursement; and all 
second and subsequent loan disbursement records to the LOC within 30 days of 

disbursement; 
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n-22 


Under Required Management Assertion, add: 

FOR FISCAL YEARS STARTING ON OR AFTER JULY 1, 1996, THESE 
COMPLIANCE REQUIREMENTS MUST BE TESTED AT INSTITUTIONS THAT 
RECEIVED MORE THAN $300,000 OF TITLE TV FUNDING THROUGH ONE 
OPE ID NUMBER DURING THE FISCAL YEAR BEING AUDITED. 


n-25 


Contact Office. Delete the address and telephone numbers and insert: 
U. S. Department of Education 

Performance Improvement and Procedures Division, IPOS 

Attn: Financial Analysis 

600 Independence Avenue, SW 

ROBS, Room 3682 

Washington, DC 20202-5265 

Tel. (202) 260-5742 
Fax: (202) 708-6730 


11-25 


After this page insert the new part 8, pages 11-26 through 11-29, and Sections III 
and IV. 



SECTION III ILLUSTRATIVE REPORTS AND APPENDICES - should read SECTION 





V 


Section V 


After the caption. Example B. delete: Report Package Cover Pace and insert: 
Compliance Report Section. 

After the caption, Example B, insert: Example B-l Servicer Cover Page 

After the caption, Example C, insert: Example C-l Servicer Information Sheet 


Section V 


After the caption. Appendix D. delete the word: Downloading. 


Example B 


Delete caption: REPORT PACKAGE COVER PAGE and insert: COMPLIANCE 
REPORT SECTION 

In the Note: delete the words: report cover, and insert: pave 
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Example B 

Example B 
Example C 

Example C 
Example D 

Appendix B 

Appendix D 
Appendix D 



Bottom of page, caption FOR THE AWARD YEAR ENDING JUNE 30, 19XX, 
delete the word: AWARD and insert: FISCAL, delete: June 30. 19XX and insert: 
Month Day, Year. 

After this Example, insert Example B-l . 

Page 2 of 2. Paragraph starting: The entity utilizes an SFA Servicer delete this 

paragraph as Example C-l is required if an entity utilizes a Servicer. 

After this Example, insert Example C-l. 

In this Example, replace the word flnstitutionl with [Institution I Servicer] , also 
insert after the date, June 1995, the words as updated. 

Third box under the caption, Cash Management, delete one of the words, between 
and after general insert the word ledger. 

Delete page 1 and paragraphs 4 and 5 on page 2. Insert new page 1 attached. 
Page 3, delete the paragraph following the caption Multiple Schools and insert: 
The software program provides for data entry for multiple institutions. 

Utilities Menu 

This menu contains a READ ME file which provides information on how to operate 
the software program. IPAs are strongly encouraged to view or to print and read 
this information before running the software program. 
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ENGAGEMENT PERIODS AND REPORT DUE DATES 

Effective for reports submitted on or after July 1, 1997 the annual periods to be audited are: 

► Institution's basic GAAP financial statements, based on the institution's fiscal year, in 
accordance with Government Auditing Standards and generally accepted auditing 
standards; and 

► Compliance based on the institution's fiscal year by examining and reporting on the 
institution management's assertions about compliance with specified SFA laws and 
regulations, in accordance with SSAE No. 3 and Government Auditing Standards. 

Institutions may engage different IPAs to perform the audit of the financial statements and the 
compliance attestation engagement. 

A combined financial statement and compliance attestation report package is due six months 
following the fiscal year end as shown below. This change in the compliance audit period from 
an award year to a fiscal year requires a separate compliance attestation report package that is 
also due which covers the period from the date of the last compliance report (should be period 
ending June 30, 1995) to the end of the fiscal year prior to the first fiscal year compliance audit 
(34 CFR 668.23). 



Institution's Fiscal 
Year Ending 


Due Date 


Financial Statement and 
Compliance Attestation 
Report Package for 
Fiscal Year Ending 


Stub Period Compliance 
Attestation Report 
Package Covers 


March 31, 1997 


September 30, 1997 


March 31, 1997 


7/1/95 - 3/31/96 


June 30, 1997 


December 31, 1997 


June 30, 1997 


None 


September 30, 1997 


March 31, 1998 


September 30, 1997 


7/1/96 - 9/30/96 


December 31, 1997 


June 30, 1998 


December 31, 1997 


7/1/96-12/31/96 


March 31, 1998 


September 30, 1998 


March 31, 1998 


7/1/96 - 3/31/97 


June 30, 1998 


December 31, 1998 


June 30, 1998 


None 



The institution's failure to meet report due dates may result in administrative sanctions described 
in 34 CFR 668, Subpart G. Questions concerning report periods and due dates should be 
addressed to the Performance Improvement and Procedures Division, IPOS, contact office shown 
on Page 1-8. 
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MATTERS REQUIRING IMMEDIATE ACTION 
Irregularities or Illegal Acts 

This Guide requires practitioners to design and perform procedures to provide reasonable 
assurance of detecting significant illegal acts and to report directly to the ED Office of Inspector 
General any fraudulent act or indication of such acts. In addition, paragraph 30 of SSAE No. 3 
says that an examination-level engagement includes “designing the examination to detect both 
intentional and unintentional noncompliance that is material to management’s assertion.” 
Accordingly, practitioners should be aware of fraud or high risk areas and recognize basic 
weaknesses in internal controls. See Appendix B for a list of high risk indicators or conditions a 
practitioner may encounter while performing the compliance engagement. 

As described in Paragraph 4.16 of Government Auditing Standards , if the practitioner becomes 
aware of fraud or indications of fraud, the practitioner should exercise due professional care to 
avoid any actions that would compromise the protection of an individual's rights and the integrity 
of any official inquiries. Upon discovery of a fraudulent act or indication of such an act related 
to Federal programs, this Guide requires the practitioner to immediately contact the ED Office of 
Inspector General, Investigation Services, by phone or fax at the numbers shown below before 
extending audit steps and procedures. In addition, the practitioner must promptly prepare a 
separate written report concerning fraudulent acts or indications of such acts and include all 
information described in Section IV on reporting findings. This report should be submitted to the 
ED Office of Inspector General, Investigation Services, within 30 days after the date of discovery 
of the act or within the time frame agreed to by the practitioner and the ED Office of Inspector 
General, Investigation Services. The practitioner shall submit this report to the Assistant Inspector 
General for Investigations at this address: 

Assistant Inspector General for Investigations 

U. S. Department of Education 

600 Independence Avenue, SW, Room 4122, MES 

Washington, D.C. 20202-1510 

Phone: 202-205-8762 

Fax: 202-205-9449 

For supplemental guidance, see Chapters 4 and 5 of Government Auditing Standards. In addition, 
practitioners may wish to consult SAS No. 53, The Auditor's Responsibility to Detect and Report 
Errors or Irregularities, SAS No. 54, Illegal Acts by Clients (AICPA, Professional Standards, 
vol. 1, AU sec. 317) and SAS No. 82, Consideration of Fraud in a Financial Statement Audit. 
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Due Care and Professional Skepticism 

Paragraph 3.26 of Government Auditing Standards states that due professional care should be used 
in conducting the audit and in preparing related reports. Paragraph 37 of SSAE No. 3 requires 
that the practitioner “exercise (a) due care in planning, performing, and evaluating the results of 
his or her examination procedures and (b) the proper degree of professional skepticism to achieve 
reasonable assurance that material noncompliance will be detected.” This Guide cautions 
practitioners against ignoring basic weaknesses in internal controls, performing audit steps 
mechanically (auditing form over substance), and accepting explanations for audit exceptions 
without question. 
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Federal Direct Loan Program (FDLP) 

Eligible students or their parents may obtain a FDLP to pay for the student's cost of education. 
ED makes low interest loans to students and/or parents, the loans are disbursed by participating 
institutions. An institution may simultaneously participate in FDLP and FFELP but a student or 
parent borrower may not borrow under both programs during the same period of enrollment. 

FDLP is a new program that is changing annually. You should obtain and review the institution’s 
copy of the Direct Loan School Guide for the year(s) being audited. Institutions participate under 
one of three School Origination Options. Key concepts contained in the 1996-97 School Guide 
for each option follow. 



For the 1995-96 Award Year 


Level 2 


Level 1 


Alternative 

Origination 


For the 1996-97 Award Year 


Option 1 


Option 2 


Standard 


Functions 


Create loan origination record 


School 


School 


School 


Transmit record to Loan Origination 
Center(LOC) 


School 


School 


School 


Prepare promissory note 


School 


School 


LOC 


Obtain completed/signed promissory note from 
borrower 


School 


School 


LOC 


Transmit promissory note to LOC 


School 


School 


N/A 


Determine funding needs 


LOC 


School 


LOC 


Initiate drawdown of funds 


LOC 


School 


LOC 


Receive funds electronically 


School 


School 


School 


Disburse loan to borrower 


School 


School 


School 


Create disbursement record 


School 


School 


School 


Transmit disbursement record to LOC 


School 


School 


School 


Reconcile on monthly basis (Data Matching) 


School 


School 


School 
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The FDLP is an electronic program except for the original promissory note which is mailed to the 
LOC. Electronic records are created, exported (batched), and transmitted to the LOC and 
acknowledged (imported from) the LOC, a cycle approach. A cycle is not complete until the last 
activity in it is finished, i.e., an action has been accepted by the LCC and the school’s system 
reflects the acceptance. FDLP has five types of cycles: Loan Origination Records(one for each 
loan), Promissory Note Manifests, Disbursement Records, Change Records and Reconcilement 
Records. For a loan to be “booked,” the institution must have electronically transmitted to the 
LOC and the LOC must have accepted these records: 

Loan origination record; 

Promissory Note Manifest (matched with the paper promissory note sent by the 
school/student); and 

First disbursement of loan proceeds. 

Unique to FDLP : Direct Loan funds do not appear on the PMS 272; 

There is no Direct Loan application, the FAFSA serves as the application. 

The borrower’s original accepted promissory note will not be at the institution. 
However, some institutions have opted to keep a copy of the note but the institution 
is not required to keep a copy. 

Federal Perkins Loan 

The Federal Perkins Loan provides loans to students. Institutions maintain a revolving loan fund 
started with a Federal capital contribution and a matching institutional capital contribution. 
Principal and interest repayments and reimbursements for canceled loans are deposited into this 
fund. The institution, in turn, is fully responsible for administering the program (i.e., approving, 
disbursing and collecting the loans). 

Federal Work Study (FWS) 

The FWS program provides part-time employment to needy students and is intended to broaden 
the range of worthwhile job opportunities for students. Students apply directly to and are selected 
by, the institution. The institution determines the award amount, job placement, and pays the 
student. 
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Payment Periods: 



Effective July 1, 1997, there is a uniform definition of payment period for the Title IV programs 
(except for FWS) as follows: 

For an eligible program that has academic terms, measures progress in credit hours, and is offered 
in semesters, trimesters, quarters or other academic terms, the payment period is the semester, 
trimester, quarter, or other academic term. 

For an eligible program that measures progress in credit hours and does not have academic terms 
or measures progress in clock hours: (1) For a student enrolled in an eligible program that is one 
academic year or less in length ~(i) the first payment period is the period of time in which the 
student completes the first half of the program as measured in credit or clock hours; and (ii) the 
second payment period is the period of time in which the student completes the second half of the 
program as measured in credit or clock hours. (2) For a student enrolled in an eligible program 
that is more than one academic year in length ~(i) For the first academic year and any subsequent 
full academic year as measured in credit or clock hours -(A) the first payment period is the period 
of time in which the student completes the first half of the academic year as measured in credit or 
clock hours; and (B) the second payment period is the period of time in which the student 
completes the second half of that academic year; (ii) for any remaining portion of an eligible 
program that is more than one-half an academic year but less than a complete academic year ~ (A) 
the first payment period is the period of time in which a student completes the first half of the 
remaining portion of the eligible program as measured in credit or clock hours; and (B) the second 
payment period is the period of time in which the student completes the remainder of the eligible 
program; and (iii) for any remaining portion of an eligible program that is not more than half an 
academic year as measured in credit or clock hours, the payment period is the remainder of the 
eligible program (34 CFR 668.4). 

There are additional requirements on payment periods. The IPA should familiarize him or 
herself with the entire payment period definition. 

The institution may make direct disbursements to students or credit students' accounts. If the 
institution credits student accounts, it must either give students receipts or notify students of the 
payment. Specific program requirements are: 
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8. PERKINS COLLECTIONS AND DUE DILIGENCE 
Required Management Assertion 

[Institution] complied with the Perkins Collections and Due Diligence compliance 
requirements listed in section II of the ED SFA Guide. 

Compliance Requirements 

SFA compliance requirements concerning Perkins Collections and Due Diligence are contained 
in 34 CFR 674. The institution must exercise due care and diligence in the collection of loans. 
The regulations covering the deferment of repayments of Perkins Loans are shown in 34 CFR 
674.34 and .35 In addition, the deferment procedures are contained in 34 CFR 674.38. Due 
diligence requirements are contained in 34 CFR 674 Subpart C. 

Deferment of Payments: 

Payments on Federal Perkins Loans may be deferred during particular periods based on the date 
of the loan. The borrower need not repay principal, and interest does not accrue, except that 
interest does accrue during a hardship deferment for loans made before July 1, 1993. Deferments 
may only be granted when requested in writing and submitted to the school by its due date and 
with required documentation. A borrower is entitled to a 6-month grace period (post-deferment 
grace period) after each deferment and neither the deferment nor the grace period is included in 
determining the 10-year repayment period. Below is information on three types of deferments, 
you should review Chapter Six of The Federal Student Financial Aid Handbook applicable to the 
audit period for additional information concerning deferments. 

In-school deferment; 

Deferments may be given to borrowers who are regular students enrolled at least half-time in an 
eligible institution of higher education or a comparable institution outside the U.S. approved by 
ED for this purpose. It is not a requirement that the school participate in the Federal Perkins Loan 
Program in order for the borrower to qualify for an in-school deferment. For loans made on or 
after July, 1993, borrowers who are in approved graduate fellowship programs, rehabilitation 
training programs for disabled individuals, or are engaged in graduate or post-graduate fellowship- 
supported study also qualify for an in-school deferment. However, deferments may not be granted 
to a borrower while serving in a medical internship or residency program, except for a residency 
program in dentistry. 

Economic Hardship Deferment; 

For Federal Perkins loans made on or after July 1, 1993, a deferment of up to three years may be 
granted for economic hardship. To qualify, the borrower must be seeking and unable to find full- 
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time employment or be suffering an economic hardship. To qualify as suffering economic 
hardship, the borrower must provide documentation satisfactory to the institution showing 
economic hardship as described in 34 CFR 674.34. 

Three Year Deferments; 

A borrower of a Federal Perkins Loan made before July 1, 1993, may defer repayment for up to 
three years and interest will not accrue while the borrower is: 

a member of the U.S.Army, Navy, Air Force, Marines, or coast guard; 

a member of the National Guard or the reserves serving a period of full-time active duty 
in the Armed Forces; 

an officer in the Commissioned Corps of the U.S. Public health Service; 

On full-time active duty as a member of the National Oceanic and Atmospheric 
Administration Corps; 

a Peace Corps volunteer; 

a volunteer under Title I-Part A of the Domestic Service Act of 1973 (ACTION); 

A full-time volunteer in service for a tax-exempt organization that ED has determined is 
comparable to Peace Corps or ACTION service; or 

Temporarily totally disabled or unable to work because he or she must care for a spouse 
or other dependent who is so disabled. 



Cancellation: 

A borrower may have all or part of his or her loan (including interest) canceled for engaging in 
public service such as teaching or service in programs such as Head Start, Peace Corps, and 
ACTION, or service in the military. The borrower must apply for cancellation of the loan by 
obtaining the appropriate cancellation form from the business or student loan office of the school 
that made the loan or its servicer. The form and any required documentation must be submitted 
on a timely bases. The conditions which apply and the loan amounts which may be canceled vary 
depending on the date of the loan and the type of service performed to qualify for the cancellation. 
The auditor should review Chapter Six of The Student Financial Aid Handbook applicable to the 
audit period to determine the specific criteria which apply. 
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Billing and Collections: 



Billing refers to that series of actions the school routinely performs to notify borrowers of 
payments due, remind them of overdue payments, and demand payment of overdue amounts. 
Generally, repayments begin after a grace period of either six or nine months. An “initial grace 
period” of nine months immediately follows a period of enrollment and immediately precedes the 
date repayment is required to begin for the first time. A borrower who returns to school on at 
least a half-time basis prior to completion of the initial grace period is entitled to a full initial grace 
period. The school must contact the borrower during both initial and post-deferment grace periods 
to remind him or her when repayment will begin. If a payment is overdue and the school has not 
received a request for deferment, postponement, or cancellation, the school must send the 
borrower an overdue notice. A first notice must be sent within 15 days after the due date, a 
second notice within 30 days after the first notice and a final demand sent within 15 days after the 
second notice. If the borrower does not respond to the final demand letter within 30 days, the 
school must try to make contact by telephone before beginning collection procedures. 

Collection procedures are the more intensive efforts a school must make when borrowers have not 
responded satisfactorily to billing procedures and are considered seriously in default. The first 
step a school must take in the collections process is to report a defaulted loan account to a national 
credit bureau organization with which ED has an agreement. The second step the school must take 
is to use its own personnel to collect or hire a collection firm. If efforts cannot convert the 
account to regular repayment status within 12 months (or the borrower does not qualify for 
deferment, postponement, or cancellation), the school must either litigate or make a second effort 
to collect. The second effort to collect requires that: 

If the school first attempted to collect by using its own personnel, it must refer the account 
to a collection firm, unless state law prohibits it; or 

If the school first used a collection firm, it must use a different firm or its own personnel, 
or submit the account to ED for assignment. 

If a collection firm (retained by a school as part of its second effort to collect) cannot place 
an account into regular repayment status by the end of 12 months (or if the borrower does 
not qualify for deferment, postponement, or cancellation), the firm must return the account 
to the school. 



The school must continue to make annual attempts to collect the account until: 
the loan is recovered through litigation; 
the account is assigned to ED; or 



the loan is written off. 
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The school must assess all reasonable collection costs against the borrower, without regard to the 
provisions of state law. The school determines what collection costs are “reasonable,” as long as 
they are based on actual costs the school incurs for the particular borrower, or on average costs 
incurred in collecting loans in similar stages of default. The school must be able to document the 
basis for the costs assessed. Schools may waive all or a portion of collection costs or make other 
compromises or consolidations based on a number of factors. The auditor should review Chapter 
Six of The Student' Financial Aid Handbook applicable to the audit period to determine the 
conditions which apply. 

The school may use a contractor for billing or collection, but the school is still responsible for 
complying with Subpart C regulations about those activities. For example, the school is still 
responsible for deciding whether to sue a borrower in default. A school may not use a billing 
service or a collection Firm that owns or controls the other, or are owned or controlled by the 
same corporation, partnership, association, or individual. 

Su ggested Procedures 

♦’a. Review, evaluate, and document the institution's methodologies for determining 
compliance with Perkins collections and due diligence requirements. 

b. Select a sample of Federal Perkins Loans which are representative of the loans in 
the schools portfolio and test their compliance with applicable SFA requirements. 

For example, for loans that have entered a grace period or repayment, determine 
that the proper number of contacts were made and that billing notices were 
appropriately given. Be aware at the grace periods and billing periods are 
measured in days not months or portions thereof. Verify that proper 
documentation exist for any deferments or cancellations. 



1 ^Review, evaluate and document means: the IPA must document his/her understanding of the relevant 
portions of the internal control structure and the assessed level of control risk. 
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SECTION III 




PLANNING AND OTHER CONSIDERATIONS 
E QR AUDITS OF INSTITUTION SERVICERS 



PURPOSE OF THIS SECTION 

This section is to assist independent public accountants (IPAs) engaged to performed compliance 
attestation engagements of third-party service organizations [servicer(s)] when the functions 
performed are applicable to the administration of the U.S. Department of Education (ED) Federal 
Student Financial Assistance (SFA) Programs. 

To the extent that an institution contracts with a servicer to administer any aspect of the SFA 
Programs, the applicable compliance requirements and guidance contained in other Sections of the 
Guide also apply to that servicer. This section must be used by the IPA to attest to the 
management assertions about compliance with the SFA programs made by any institution servicer 
participating in or administering any aspect of the SFA programs, except for institution servicers 
which obtain an audit in accordance with the Single Audit Act, OMB Circular A- 133 or its 
predecessors. However, this Guide must be used if a program specific audit is being performed 
to satisfy the single audit requirements. 



• This guidance is not intended to be a complete manual of procedures, nor is it intended to supplant 
the IPA's judgment of the work required. Suggested procedures described may not cover all 
circumstances or conditions encountered. The IPA should use professional judgment and due care 
to tailor the procedures so that the compliance attestation engagement objectives are achieved. 
However, all applicable management assertions contained in this update must be addressed by the 
IPA. The IPA should contact the cognizant Regional Inspector General for Audit for technical 
assistance related to performing the engagement. (See Appendix C) 




REQUIREMENTS ANP STANDARDS FOR SERVI CER ATTESTATION ENGAGEMENTS 
Annual Compliance Audit 

Section 487(c)(C)(I) of the Higher Education Act of 1965, as amended, (HEA) requires annual 
compliance audits of servicers with regard to any contract with an eligible institution, guaranty 
agency or lender for administering or servicing any aspect of the student financial assistance (SFA) 
programs. The HEA requires that these audits be performed in accordance with the U.S. General 
Accounting Office's Government Auditing Standards, issued by the Comptroller General of the 
United States. This Audit Guide provides guidance in satisfying the annual compliance audit 
requirement by performing an examination level attestation engagement of compliance and internal 
control over compliance under AICPA Statement on Standards for Attestation Engagements 
(SSAE) No. 3, Compliance Attestation. 
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Part 668.23 of Title 34 of the Code of Federal Regulations (CFR) requires that all servicers have 
an annual compliance audit performed of the servicer’s administration of the participation in the 
Title IV, HEA programs of each institution with which the servicer has a contract, UNLESS: 

—the servicer contracts with only one participating institution; and 
—the audit of that institution’s participation involves every aspect of the servicer's 
administration of that Title IV program. 

SFA compliance attestation objectives are to determine and report whether the servicer 
management’s assertions relative to compliance and internal control over compliance with 
specified compliance requirements in Section IV of this guide are fairly stated in all material 
respects (institutional eligibility and participation, reporting, student eligibility, disbursements, 
refunds, cash management, close out examinations, Perkins collections and due diligence, servicer 
eligibility, and servicer systems and internal controls). 

ED in part meets its stewardship responsibilities by acting upon noncompliance and internal 
control weakness noted in the IPA’s reports. Therefore, IPA’s reports must contain adequate 
information to give reported matters perspective and to allow ED to take necessary corrective 
action. 

These annual compliance audit requirements are considered satisfied by an audit conducted, where 
applicable, in accordance with the Single Audit Act, the Office of Management and Budget (OMB) 
Circular A-133, or its predecessors. 



Standards for Servicer Attestation Engagements 

The servicer's compliance attestation engagement shall be conducted by an independent auditor 
in accordance with the U.S. General Accounting Office's (GAO), Government Auditing Standards 
(GAS), issued by the Comptroller General, of the United States. This update requires an 
examination-level attestation engagement relative to a servicer management's assertions about 
certain compliance aspects related to SFA program participation as identified in Section IV. 
Therefore, in addition to applicable standards contained in the GAS, the Statement on Standards 
for Attestation Engagements (SSAE) No. 3, Compliance Attestation , issued by the American 
Institute of Certified Public Accountants (AICPA) also applies. An IPA engaged to perform a 
servicer compliance attestation engagement should also refer to Section I of this Guide for 
guidance concerning matters requiring immediate action, auditor qualifications, engagement 
letters, follow-up on prior audit findings, corrective action plan, quality control reviews, and 
future revisions as much of that guidance is not repeated in this section. 
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ENGAGEMENT PERIODS AND REPORT DUE DATES 
First Year Engagements 

A servicer's First engagement must cover the servicer's activities for the fiscal year , ending on or 
after July 1, 1996. Since regulations require audits for periods on or after July 1, 1994, in which 
the servicer administered any aspect of an institution’s participation in the Title IV, HEA 
programs, ED reserves the right to request copies of audits for fiscal years prior to July 1, 1996. 

Subsequent Engagements 

Each subsequent annual engagement must cover the servicer's activities for the entire period of 
time (fiscal year) since the servicer's preceding engagement. 

Due Dates 

An institution’s servicer shall submit its engagement report to ED within six months of the end 
of the servicer’s fiscal year or, if applicable, in accordance with deadlines established in the Single 
Audit Act, OMB Circular A-133 or its predecessors. An institution’s servicer’s first engagement 
under this Guide must be submitted within six months after the issuance of this Section or six 
months after the end of the servicer’s fiscal year, whichever is later. 

A servicer's failure to meet report due dates may result in administrative sanctions described in 
34 CFR 668, Subpart G. 



SERVICER'S REPORTING ENTITY 

Contracting With More Than One Institution, Lender or Guaranty Agency 

A servicer that contracts with more than one participating institution may submit a single 
compliance attestation report that covers the applicable compliance requirements in Section IV of 
this Guide relating to the servicer’s administration of the participation in the Title IV, HEA 
programs for each institution with which the servicer contracts. 

A servicer that contracts with both an institution and a lender may not submit a single compliance 
attestation report to cover the servicer’s participation in all of the Title IV, HEA programs. The 
servicer reports for lenders or guaranty agencies must be separate from the servicer audits for 
institutions because the services provided to each are markedly different. 
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SERVICER RESPONSIBILITIES 

The servicer’s management should assess the services it provides and whether it can make all or 
part of the applicable assertions in Section IV of this Guide. Scope limitations because of a 
servicer management’s refusal to provide the applicable assertions may result in the servicer being 
subject to administrative actions listed in 34 CFR 668 Subpart G. 



Servicer Corrective Action Plan 

To assist in resolving instances of noncompliance, reportable conditions, and material weaknesses 
in the internal controls identified by the IPA, ED requires a servicer to develop a corrective action 
plan as part of its report. The corrective action plan is considered an essential part of the report 
requirement for the Title IV, HEA Programs. The corrective action plan is prepared by the 
servicer on the servicer’s letterhead, and includes the name, title, and telephone number of the 
servicer official responsible for its preparation. 

The corrective action plan must describe the corrective action taken or planned in response to 
findings identified by the IPA. In addition, the servicer must comment on the status of corrective 
action taken on prior findings. A suggested format for the corrective action plan is provided in 
Example H of Section V of this Guide. 



PRACTITIONER RESPONSIBILITIE S 

Engagement and Management Representations 

The compliance attestation engagement must be performed as an examination-level engagement 
in accordance with SSAE No. 3 and Government Auditing Standards. The IPA is required to 
obtain written assertions from management as part of a compliance attestation engagement 
performed in accordance with SSAE No. 3. The nature of the written management assertions 
made by the servicer’s management and the scope of the engagement may vary depending on the 
extent an institution has contracted with the servicer to perform certain compliance functions. Such 
assertions should be obtained from management in a letter of representation to the EPA. The letter 
of assertions should identify the services provided for which the servicer is responsible. The 
matrix in Example C-l must be prepared and included as part of the reporting package. 

All applicable management assertions contained in Section IV of the Guide must be addressed 
by the IPA. In addition to the specific assertions identified in that part, as applicable, 
management's written representations should include the matters required by paragraph 70 of 
SSAE No. 3. Paragraph 71 of SSAE No. 3 discusses the EPA's responsibility when management 
refuses to furnish all appropriate written representations. 
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PLANNING CONSIDERATIONS FOR SERVICER ATTESTATION ENGAGEMENTS 



Purpose and Objective of Servicer Attestation Engagements 

The overall purpose of the servicer engagements is to provide ED assurance that the servicer has 
complied with and has effective internal controls over the compliance requirements listed in 
Section IV of this Guide applicable to the servicer's administration of the participation in the SFA 
programs. 



Consideration of the Servicer's Internal Controls 




Overall guidance for the consideration of the internal controls and reporting requirements in an 
examination-level engagement is provided in Government Auditing Standards and in paragraphs 
44-46 of SSAE No. 3. Paragraph 44 of SSAE No. 3 states that the practitioner should obtain an 
understanding of relevant portions of the internal controls over compliance sufficient to plan the 
examination engagement and to assess control risk for compliance with the specified requirements 
(that is, compliance requirements specified in Section IV of this guide). This guide further 
requires the practitioner to document his or her consideration of the servicer's policies and 
procedures and assessment of control risk. Section IV of this guide highlights the suggested 
procedures that have related internal control and risk assessment documentation requirements by 
the use of an 



During an examination-level attestation engagement, the IPA may become aware of reportable 
conditions or material weaknesses in the servicer’s internal controls over compliance. A 
reportable condition is a significant deficiency in the design or operation of the internal controls 
over compliance that could adversely affect the servicer’s ability to comply with the specified 
requirements. A material weakness is a reportable condition in which the design or operation of 
the internal controls does not reduce to a relatively low level the risk that noncompliance with one 
or more of the specified requirements could occur and not be detected within a timely period by 
employees in the normal course of performing their assigned functions. The IPA's responsibility 
to communicate these deficiencies in an examination of management's assertion is similar to the 
IPA's responsibility described in SAS No. 60. However, this guide requires all communications 
of reportable conditions and material weaknesses in the internal controls over compliance to be 
in writing and requires the IPA to include a copy of such report(s) in the IPA's reporting package. 



Except for reporting reportable conditions and material weaknesses as described above, no other 
reporting on the internal controls over compliance is required. The Government Auditing 
Standards requirement for a report on internal controls based on performing a financial-related 
audit does not apply. 
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